topic Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe in Advanced Threat Prevention Discussions

Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

Retired Member — Tue, 14 Apr 2020 13:07:33 GMT

Hi,

Since yesterday April 13/2020 I have been getting Virus alerts in the Threat log on my PAN 3020. It has pointed out that OneDriveSetup.exe is the culprit.

I went to a few machines and searched for OneDriveSetup.exe and uploaded it to VirusTotal. All came back clean. I then ran a malware scan (Cortex) on a few machines and again it came back clean. I waited until today to see if the new AV signatures were adjusted, but they were not as I am still getting alerts today.

Has anyone else received these? From what I am seeing it is looking like a false positive.

Thanks

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

hisingh — Tue, 14 Apr 2020 15:12:59 GMT

Hello @Retired Member

Thank you for bringing this to our attention. We have noticed a few other similar issues. I am glad it is been resolved. Please let me know if I can answer any more questions.

Best

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

AaronBeck — Tue, 14 Apr 2020 15:27:45 GMT

Good morning @hisingh

We are still seeing these alerts. How did you resolve the problem?

Thanks!

-Aaron

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

Retired Member — Tue, 14 Apr 2020 15:56:30 GMT

@hisingh ,

This is NOT resolved. This is STILL a problem.

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

abrickeen — Tue, 14 Apr 2020 17:52:06 GMT

This appears to be a false positive kicked off by the latest sync app update.

https://docs.microsoft.com/en-us/onedrive/sync-client-update-process

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

Retired Member — Tue, 14 Apr 2020 17:57:20 GMT

@abrickeen I would agree it is likely a false positive. We need PAN to adjust their content signatures.

For me, this started with the Antivirus 3316-3827 content version.

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

hisingh — Tue, 14 Apr 2020 22:11:56 GMT

Hello @Retired Member

Can you share the hash please, I will check the current status.

Best

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

hisingh — Tue, 14 Apr 2020 22:26:42 GMT

Hello @Retired Member, @abrickeen, and @AaronBeck

Thank you for waiting for my response. If you all are seeing the TID: 341427639, this signature is been disabled today, which means Wildfire signature is disabled immediately, and the AV signature will be disabled tomorrow if nothing goes wrong. You can safely put in a threat exception for Threat ID: 341427639 to get traffic moving again.

If your threat ID is different then 341427639, share it with me.

Best regards,

Himani

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

Retired Member — Tue, 14 Apr 2020 22:45:21 GMT

Thanks @hisingh . I will check tomorrow to see if this behavior stops. Does this mean there was an issue identified with the Antivirus content?

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

Retired Member — Wed, 15 Apr 2020 12:56:19 GMT

@hisingh I still see the EXE being flagged as a virus. Today, with the new content updates, the virus is being flagged differently.

Virus/Win32.WGeneric.ajepxx

ID 341677293

@AaronBeck @abrickeen are you seeing this as well?

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

AaronBeck — Wed, 15 Apr 2020 14:41:22 GMT

@Retired Member

It looks like it stopped around 5:10:41 AM PST 4/15/2020.

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

hisingh — Wed, 15 Apr 2020 15:22:26 GMT

Hello @Retired Member

I am glad the signature 341427639, is been disabled.

This new signature, Virus/Win32.WGeneric.ajepxx, has a very high VT detection https://www.virustotal.com/gui/file/002a33f2f0d47c03a80539b71f3a312d146fa8c671ce8627254cfa0dd55d3407/detection

Are you sure it is detected in OneDriveSetup.exe

Best

Himani

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

Retired Member — Thu, 16 Apr 2020 12:43:55 GMT

@hisingh I have had no alerts for 24 hours now. I would consider this resolved at this point.

Thanks

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

AaronBeck — Tue, 30 Jun 2020 20:32:07 GMT

This has recently started occurring again and is filling up my SIEM. Please help @hisingh !

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

hisingh — Tue, 30 Jun 2020 21:37:50 GMT

Hello @AaronBeck

Thanks for sharing with me.
This signature is disabled since April 2020. How are you seeing it?

https://threatvault.paloaltonetworks.com/?query=Win32.WGeneric.ajdriy&type=

Best

Himani

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

AaronBeck — Tue, 30 Jun 2020 21:45:54 GMT

Ah, it appears to be a different name now but is triggering on the same file.

oneclient.sfx.ms/Win/Prod/20.084.0426.0007/OneDriveSetup.exe

Virus/Win32.WGeneric.aktxlj

348874710

https://threatvault.paloaltonetworks.com/?query=348874710

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

AaronBeck — Tue, 30 Jun 2020 21:52:59 GMT

It actually looks like there are multiple:

@hisingh

Virus/Win32.WGeneric.aktxlj

Virus/Win32.WGeneric.aktpum

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

hisingh — Tue, 30 Jun 2020 23:15:30 GMT

I have asked the team to check Virus/Win32.WGeneric.aktxlj, I will update.

Win32.WGeneric.aktpum is disabled already.

Best

Himani

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

AaronBeck — Tue, 30 Jun 2020 23:30:30 GMT

Win32.WGeneric.aktpum Stopped at 7:10 this morning, was this just turned off? @hisingh

Re: Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

hisingh — Wed, 01 Jul 2020 05:47:43 GMT

Virus/Win32.WGeneric.aktxlj is a malware

Win32.WGeneric.aktpum was disabled on 06-28-2020.

Best

Himani